Audit of the Hampden County District Attorney’s Office (November 28, 2023)
November 28, 2023 · Hampden County District Attorney’s Office · Read the full official report on mass.gov ↗
source
“HCDA did not provide cybersecurity awareness training to its employees.”
Read the plain-English breakdown
This is a Massachusetts State Auditor performance audit of the Hampden County District Attorney’s Office covering July 1, 2019 through June 30, 2021.
“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has performed an audit of the Hampden County District Attorney’s Office (HCDA) for the period July 1, 2019 through June 30, 2021.”
Auditors checked whether the office followed rules for forfeiture fund spending, collecting and depositing forfeited assets, and employee cybersecurity training.
“In this performance audit, we examined the following:”
If staff are not trained to spot and avoid cybersecurity risks, the office is more vulnerable to attacks, money losses, and damage to public trust.
“Without educating its employees on their responsibility to protect the security of information assets, HCDA is exposed to a higher risk of cybersecurity attacks and financial and/or reputational losses.”
This matters to residents because the office prosecutes crimes in Hampden County and serves about 460,000 people across 23 cities and towns.
“HCDA serves 23 cities and towns across southwestern Massachusetts and serves a population of about 460,000 citizens.”
The money-related areas tested passed, but cybersecurity training did not.
“No; see Finding 1”
The auditor recommended a cybersecurity training policy and training for employees within 30 days of orientation and every year after that; the office said those recommendations have been implemented.
“Therefore, the recommendations resulting from the finding have been implemented.”
This was not a broad finding of financial misuse; auditors said the office’s forfeiture fund spending and handling of forfeited assets met the rules they tested.
“We noted no exceptions in our testing; therefore, we conclude that HCDA’s expenditures from its forfeiture trust fund account were allowable and in compliance with Section 47(d) of Chapter 94C of the General Laws.”
Asset forfeiture means law enforcement can take property connected to illegal drug activity, such as cash, phones, computers, vehicles, or real estate.
“Some examples of assets that may be subject to forfeiture are money, cell phones, computers, motor vehicles, and real property.”
What the Auditor checked
- Complied Were expenditures from HCDA’s forfeiture trust fund appropriate and in compliance with Section 47(d) of Chapter 94C of the General Laws?
- Complied Did HCDA ensure that all forfeited assets were collected and deposited in accordance with Section 47(d) of Chapter 94C of the General Laws?
- Did not comply Did HCDA ensure that its employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010?
What the Auditor found
Why it matters: Employees may be less prepared to protect information assets, increasing the risk of cybersecurity attacks and financial or reputational losses.
Standard: Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010, Sections 6.2.3 and 6.2.4 ( Section 6.2.3 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010; Section 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010 )
2 recommendations
- HCDA should create a policy and procedure to train new and existing employees on cybersecurity awareness.agency: already implemented
- HCDA should provide cybersecurity awareness training to its employees within 30 days of orientation and annually thereafter.agency: already implemented
Agency response & Auditor reply
Agency: "Therefore, the recommendations resulting from the finding have been implemented."
Auditor: "Based on its response, HCDA has taken measures to address our concerns on this matter."
More audits of this entity
Other Office of the State Auditor reports on Hampden County District Attorney’s Office .
- Audit of the Hampden County District Attorney’s OfficeDistrict Attorney · September 13, 2018